Kibana allocation of resources without limits or throttling leads to crash (ESA-2024-26)
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.
Affected Versions:
Kibana up to 7.17.23 and up to 8.14.2
Solutions and Mitigations:
The issue is resolved in version 7.17.23 and 8.14.2.
Severity: CVSSv3.1: 6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2024-52973